I am not sure how easy it would be to do a DDOS attack on the BBC given that the website can cope with more than 10 - 15million users (not page views, users) a day.
Generally speaking, DDoS attacks also use specially crafted request packets to take down a web server. It's rare for you to be able to outbandwidth a DDoS
http://httpd.apache.org/security/vulnerabilities_22.html
The vulnerability fixed in 2.2.19 being a common one abused right now:
A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack.
Notice how this one is CPU-based, not bandwidth based. It's a prime candidate for DDoSing, since you may still need a large group to overwhelm the server, but it has nothing to do with bandwidth.
Then of course other DoS methods also don't use bandwidth-based attacks to take down a site.